This is an automated email from the ASF dual-hosted git repository. Aias00 pushed a commit to branch fix/005-greptime-compose-port-binding in repository https://gitbox.apache.org/repos/asf/hertzbeat.git
commit b97472cb83233016dc05b4f85d60b6efc510cc52 Author: liuhy <[email protected]> AuthorDate: Tue Jul 28 07:00:40 2026 -0700 [fix] bind greptime compose data-store ports to localhost The hertzbeat-postgresql-greptimedb docker-compose exposes the Postgres and GreptimeDB data-store ports on all interfaces (0.0.0.0). Both services run with default credentials shipped in the compose file (POSTGRES_PASSWORD=123456, the greptime static user provider greptime=greptime), so binding them to 0.0.0.0 lets any reachable host authenticate to the underlying data stores with those defaults. These ports exist only for the operator to inspect the data stores from the host; the hertzbeat container reaches them over the internal compose network and does not need the host mappings. Bind the host-side mappings to 127.0.0.1 so the default-credential services are not remotely accessible. The hertzbeat web/collector ports (1157/1158) are intentionally left unchanged. Co-Authored-By: Claude <[email protected]> --- .../hertzbeat-postgresql-greptimedb/docker-compose.yaml | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) diff --git a/script/docker-compose/hertzbeat-postgresql-greptimedb/docker-compose.yaml b/script/docker-compose/hertzbeat-postgresql-greptimedb/docker-compose.yaml index 3ad6fc796f..0e905fda9e 100644 --- a/script/docker-compose/hertzbeat-postgresql-greptimedb/docker-compose.yaml +++ b/script/docker-compose/hertzbeat-postgresql-greptimedb/docker-compose.yaml @@ -32,8 +32,11 @@ services: timeout: 5s retries: 5 start_period: 30s + # Bind data-store ports to localhost only: these services carry default + # credentials (see POSTGRES_PASSWORD / the greptime static user provider) + # and are only meant for the operator on the host, not for remote access. ports: - - '15432:5432' + - '127.0.0.1:15432:5432' environment: POSTGRES_USER: root POSTGRES_PASSWORD: 123456 @@ -58,11 +61,14 @@ services: start_period: 30s environment: TZ: Asia/Shanghai + # Bind data-store ports to localhost only: these services use the default + # static user provider (greptime=greptime) and are only meant for the + # operator on the host, not for remote access. ports: - - "14000:4000" - - "14001:4001" - - "14002:4002" - - "14003:4003" + - "127.0.0.1:14000:4000" + - "127.0.0.1:14001:4001" + - "127.0.0.1:14002:4002" + - "127.0.0.1:14003:4003" volumes: - greptime-tsdb-data:/greptimedb_data command: --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
